LOW: Auto-generated encryption key stored in same SQLite database as encrypted data #85

New Issue

Closed

opened 2026-05-31 12:04:17 -05:00 by null · 1 comment

null commented

2026-05-31 12:04:17 -05:00

Owner

Bug Description

When TOKEN_ENCRYPTION_KEY env var is not set, encryptionService.js auto-generates a random key and stores it in the user_settings table (_auto_encryption_key). This means the encryption key and the encrypted data (data_sources.encrypted_secret) are in the same SQLite file.

An attacker with database access gets both the key and the ciphertext.

Impact

Acceptable for the current threat model (filesystem access = game over regardless). But worth documenting for deployment documentation.

Recommended Fix

Document in deployment guide that TOKEN_ENCRYPTION_KEY should be set as an environment variable in production. Consider logging a warning when the auto-generated key is used.

## Bug Description When TOKEN_ENCRYPTION_KEY env var is not set, encryptionService.js auto-generates a random key and stores it in the user_settings table (_auto_encryption_key). This means the encryption key and the encrypted data (data_sources.encrypted_secret) are in the same SQLite file. An attacker with database access gets both the key and the ciphertext. ## Impact Acceptable for the current threat model (filesystem access = game over regardless). But worth documenting for deployment documentation. ## Recommended Fix Document in deployment guide that TOKEN_ENCRYPTION_KEY should be set as an environment variable in production. Consider logging a warning when the auto-generated key is used.